Security and POPIA
Children's information deserves care. Here is how Tutro limits who sees what.
You look after learners' details and parents' money. This page explains, in plain language, how access, payments and AI are handled.
Role-based access
Parents see only their own children. Tutors see only their own classes. You decide who is invited and what role they get.
Payments by Paystack
Card details go straight to Paystack. Tutro never sees or stores card numbers, and parent fees are paid out to your own bank account.
A person in charge of AI
AI drafts quizzes and suggests marks. A tutor approves every mark before a learner or parent sees it.
What is in place
- Sign-in required for every portal
- Encrypted connections throughout
- Owner-controlled invitations and roles
- Card numbers never stored by Tutro
- Tutor approval before AI marks are released
- The assistant only sees what the asker may see
- Export your records at any time
- Deletion of your company data on request
- You stay the responsible party; Tutro is your operator under POPIA
The detail. What each safeguard means day to day.
Who sees what
Owners and admins see the company. Tutors see their own classes, learners and marking queue. Parents see their own children, invoices and lessons. Learners see their own quizzes and results.
Sign-in for every portal
Every portal needs a signed-in account. Your team can sign in with Google. Parents and learners are invited by you, never self-registered into your company.
Encrypted in transit
Every connection to Tutro is encrypted.
Hosted, not shared
Records live on managed cloud infrastructure with access controls, not in shared spreadsheets or on personal phones.
The assistant respects roles
The AI assistant answers only from what the person asking is allowed to see.
POPIA roles
Your company is the responsible party for your learners' information. Tutro processes it on your behalf as an operator.
Your data, your control
You choose who is invited to your workspace and what role they have. You can export your records and ask us to remove your company’s data. Read the privacy policy for the detail.
Found a security issue?
Please tell us through the contact page and we will respond promptly.
Questions about security or POPIA?
Ask us. We will answer plainly.